DP-203 Secure, monitor, and optimize data storage and data processing Practice Test 6 — 15 Questions

Question 1

You are designing a data pipeline in Azure Data Factory that processes sensitive customer data. The pipeline must use a copy activity to move data from Azure Blob Storage to Azure Synapse Analytics. You need to ensure that data is encrypted in transit and at rest, and that the pipeline uses the most secure authentication method. Which authentication method should you use for the sink dataset?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Managed Identity. Managed Identity is the most secure authentication method because it uses Azure Active Directory (Azure AD) to authenticate to Azure Synapse Analytics without storing any credentials in the pipeline. This eliminates the risk of secret exposure and provides automatic credential rotation. SQL authentication (Option D) requires embedded credentials, service principal (Option C) requires secret management, and storage account key (Option B) is a shared secret that cannot be used to authenticate to Synapse as a sink.

Answer

Storage account key

Answer

Service principal

Answer

SQL authentication

Question 2

You need to monitor the performance of an Azure Synapse Analytics dedicated SQL pool. Which DMV should you query to find queries that are currently running and their execution status?

Accepted Answer

sys.dm_pdw_exec_requests. Sys.dm_pdw_exec_requests shows currently running requests in a dedicated SQL pool. Option A is wrong because sys.dm_pdw_nodes is a system view, not for queries. Option B is wrong because sys.dm_pdw_request_steps shows steps of completed or running requests, not high-level status. Option C is wrong because sys.dm_pdw_errors shows errors, not running queries.

Answer

sys.dm_pdw_nodes

Answer

sys.dm_pdw_request_steps

Answer

sys.dm_pdw_errors

Question 3

You are reviewing an Azure Resource Manager template for an Azure SQL Database auditing policy. Based on the exhibit, which of the following is true?

Accepted Answer

Audit logs will be written to Azure Blob Storage.. The template shows the 'state' property set to 'Enabled' and includes a 'storageEndpoint' property, which indicates that audit logs are configured to be written to Azure Blob Storage. Option A is incorrect because 'retentionDays' is set to 90 days, so logs are not retained indefinitely. Option B is incorrect because 'auditActionsAndGroups' is specified in the template, meaning default audit actions and groups are not used. Option C is incorrect because the destination is Blob Storage, not Azure Log Analytics, as indicated by the 'storageEndpoint' property.

Answer

Audit logs will be retained indefinitely.

Answer

The audit policy will use default audit actions and groups.

Answer

Audit logs will be sent to Azure Log Analytics.

Question 4

Your Azure Data Factory pipeline uses a Copy activity to load data from an on-premises SQL Server to Azure Blob Storage. You notice that the pipeline is running slower than expected. You need to identify the bottleneck. Which Data Factory monitoring metric should you analyze first?

Accepted Answer

Data Integration Unit (DIU) consumption. Data Integration Unit (DIU) consumption indicates whether the Copy activity is resource-bound and helps identify performance bottlenecks. Option A is wrong because source queue length reflects integration runtime queue depth, not a direct metric for Copy activity throughput. Option B is wrong because pipeline duration is a result of performance issues, not a metric to pinpoint the bottleneck first. Option C is wrong because activity run count is unrelated to performance analysis.

Answer

Source queue length

Answer

Pipeline duration

Answer

Activity run count

Question 5

You need to implement column-level security in Azure Synapse Analytics to restrict access to salary information. Only users with the 'HRManager' role should see salary columns. Which feature should you use?

Accepted Answer

Column-level security using GRANT on columns. Column-level security (CLS) in Azure Synapse Analytics uses GRANT on specific columns to restrict access. Option A is incorrect because row-level security filters rows, not columns. Option B is incorrect because dynamic data masking obfuscates data but does not prevent access. Option D is incorrect because Azure Purview is a governance tool, not a security enforcement mechanism.

Answer

Row-level security using security predicates

Answer

Dynamic data masking

Answer

Azure Purview data classification

Question 6

You are reviewing an ARM template for Azure SQL Database security alert policy. Based on the exhibit, which threats will trigger an alert?

Accepted Answer

SQL Injection Vulnerability and Data Exfiltration. The ARM template shows the security alert policy is enabled (state = Enabled). The disabledAlerts list includes 'Sql_Injection' and 'Access_Anomaly', meaning these two alert types are suppressed and will not trigger alerts. All other alert types (e.g., Sql_Injection_Vulnerability, Data_Exfiltration, Unsafe_Action) remain enabled and will trigger alerts. Therefore, option D is correct because SQL Injection Vulnerability and Data Exfiltration are among the enabled threats.

Answer

All alerts except SQL Injection and Access Anomaly

Answer

No alerts will be triggered because the policy is disabled

Answer

SQL Injection and Access Anomaly

Question 7

You have an Azure Data Lake Storage Gen2 account that stores parquet files. You need to ensure that files containing personally identifiable information (PII) are automatically classified and tagged. Which Azure service should you integrate?

Accepted Answer

Microsoft Purview. Microsoft Purview provides automated data classification and labeling for Azure Storage, including Azure Data Lake Storage Gen2. Option A is wrong because Azure Policy enforces rules but does not classify content. Option B is wrong because Microsoft Sentinel is a SIEM, not for classification. Option C is wrong because Microsoft Defender for Cloud is for security posture, not data classification.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 8

Which TWO actions should you take to secure access to Azure Data Lake Storage Gen2 when using Azure Synapse Analytics serverless SQL pools? (Choose two.)

Accepted Answer

Enable firewall rules and virtual network service endpoints for the storage account.. To secure access to Azure Data Lake Storage Gen2 from Azure Synapse Analytics serverless SQL pools, two effective actions are: (A) Enable firewall rules and virtual network service endpoints to restrict network access to the storage account, and (B) Use managed identity authentication from the serverless SQL pool to the storage account, which eliminates the need to store credentials and provides secure, Azure AD-based authentication. Option C (service principal with client secret) is less secure than managed identity because it requires managing secrets. Option D (shared access signature token) is not recommended for long-term access as tokens can be leaked and need to be rotated. Option E (Azure AD passthrough authentication) is not supported for serverless SQL pools; it is only available for dedicated SQL pools.

Answer

Use a service principal with a client secret to access the storage account.

Answer

Generate a shared access signature (SAS) token for the storage account and store it securely.

Answer

Use Azure Active Directory (Azure AD) passthrough authentication for the serverless pool.

Question 9

Which THREE metrics should you monitor to optimize the performance of an Azure Synapse Analytics dedicated SQL pool? (Choose three.)

Accepted Answer

Queued queries. To optimize the performance of an Azure Synapse Analytics dedicated SQL pool, monitor Queued queries (B) to detect concurrency throttling, DWU usage (C) to gauge overall resource utilization, and TempDB usage (E) as high usage can degrade performance. Storage space used (A) is a capacity metric, not a performance metric, and Login failures (D) are security-related, not performance-related.

Answer

Storage space used

Answer

Login failures

Question 10

Which TWO Azure features can be used to encrypt data at rest in Azure Blob Storage? (Choose two.)

Accepted Answer

Customer-managed keys in Azure Key Vault. Options C and D are correct. D: Storage Service Encryption (SSE) encrypts data at rest by default. C: Customer-managed keys in Azure Key Vault provide additional control over encryption keys. Option A is wrong because Azure Disk Encryption is for VMs, not Blob Storage. Option B is wrong because Azure Information Protection is for classification and labeling, not encryption at rest. Option E is wrong because TLS is for data in transit.

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Answer

Transport Layer Security (TLS)

Question 11

You are reviewing an Azure Data Factory pipeline JSON. Based on the exhibit, what will be the behavior of the Copy activity when copying files from a source folder that contains subfolders?

Accepted Answer

All files from all subfolders will be copied into a single folder in the sink.. The Copy activity is configured with recursive: true, which copies all files from all subfolders, and the sink is set to FlattenHierarchy, which places all files into a single folder without preserving the source folder structure. Option A is incorrect because staging is disabled. Option B is incorrect because recursive: true causes files from subfolders to be copied. Option C is incorrect because FlattenHierarchy does not preserve folder structure.

Answer

The copy will use staging to improve performance.

Answer

Only files in the root folder will be copied.

Answer

Files will be copied preserving the source folder structure.

Question 12

You need to monitor resource utilization for an Azure Synapse Analytics dedicated SQL pool. Which Azure Monitor metric shows the percentage of allocated DWU being used?

Accepted Answer

DWU used. The 'DWU used' metric shows the percentage of allocated DWU being consumed. Option A is incorrect because 'Memory percentage' is not the metric for DWU utilization. Option B is incorrect because 'Data IO percentage' is not the primary metric for overall DWU usage. Option C is incorrect because 'CPU percentage' does not directly represent DWU consumption.

Answer

Memory percentage

Answer

Data IO percentage

Answer

CPU percentage

Question 13

You are reviewing a script to create an external data source in Azure Synapse Analytics serverless SQL pool. Based on the exhibit, what is the purpose of the SAS token?

Accepted Answer

To provide read access to the container for querying data.. The SAS token grants read and list permissions (sp=rl) to the container, which allows the serverless SQL pool to read data from the container. Option B is incorrect because the SAS token does not have write permission (sp=rl, no write). Option C is incorrect because the SAS token does not encrypt the connection; it provides delegated access. Option D is incorrect because the SAS token is used in the credential to access storage, not to authenticate to the serverless SQL pool.

Answer

To provide write access to the container for storing query results.

Answer

To encrypt the connection between the serverless pool and storage.

Answer

To authenticate the user to the serverless SQL pool.

Question 14

Your Azure Synapse Analytics dedicated SQL pool is experiencing performance degradation. You notice that some queries are being queued due to resource class conflicts. What should you implement to optimize performance and reduce queuing?

Accepted Answer

Configure workload management with workload groups and classifiers. Workload management with workload groups and classifiers allows you to assign queries to different resource classes and prioritize them, directly addressing resource class conflicts and reducing queuing. Option A is incorrect: scaling the pool to a higher DWU increases overall resources but does not specifically manage resource class contention; it may also incur additional cost without solving the root issue. Option C is incorrect: materialized views improve query performance by pre-aggregating data but do not affect concurrency or queuing. Option D is incorrect: result-set caching reduces repeated computation for identical queries but does not resolve queuing caused by resource class conflicts.

Answer

Scale the dedicated SQL pool to a higher DWU level

Answer

Create materialized views for the most common aggregations

Answer

Enable result-set caching for frequently run queries

Question 15

Your company uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to ensure that only the 'data-scientists' group can read files in the 'processed' container, while denying access to all other users. You have already configured the storage account firewall to allow access only from your corporate network. What should you do next?

Accepted Answer

Configure access control lists (ACLs) on the 'processed' container to grant read and execute permissions to the data-scientists group and set the default ACL to deny all. In Azure Data Lake Storage Gen2 with hierarchical namespace, access control lists (ACLs) provide fine-grained permissions at the directory and file level. By granting read and execute permissions to the 'data-scientists' group on the 'processed' container and setting the default ACL to deny all, you ensure only that group can read files. Option A is incorrect because private endpoints control network access, not identity-based permissions. Option B is incorrect because RBAC roles (like Storage Blob Data Reader) grant permissions at the storage account or container level, and Azure RBAC does not support deny assignments that would block specific users while allowing others at the same scope; a deny assignment would block everyone. Option C is incorrect because managed identities are used for authenticating Azure services, not for granting permissions to a security group.

Answer

Create a private endpoint for the storage account and assign the data-scientists group to the private endpoint's access policy

Answer

Assign the Storage Blob Data Reader role to the data-scientists group at the storage account level and add a deny assignment for all other users

Answer

Use a managed identity for the data-scientists group and assign the Storage Blob Data Contributor role to the managed identity